Analysis
- max time kernel
139s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
- submitted
26/11/2023, 08:34
General
- Target 0097261726716.PDF.exe
- Size 1.8MB
- Sample231126-kgetfsfh32
- SHA256 ae5345f8b351ea82e6d74797baf379bc605c69e079cc5628ab486bf8d4b76b18
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Program crash 1 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0097261726716.PDF.exe"C:\Users\Admin\AppData\Local\Temp\0097261726716.PDF.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 19122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3324 -ip 33241⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3324-0-0x0000000002380000-0x0000000002381000-memory.dmp
memory/3324-1-0x0000000004860000-0x0000000005860000-memory.dmp
memory/3324-2-0x0000000000400000-0x00000000005CF000-memory.dmp
memory/3324-3-0x0000000000400000-0x00000000005CF000-memory.dmp
memory/3324-4-0x0000000004860000-0x0000000005860000-memory.dmp
memory/3324-6-0x0000000002380000-0x0000000002381000-memory.dmp
memory/3324-7-0x0000000000400000-0x00000000005CF000-memory.dmp